Closed Bug 733004 Opened 14 years ago Closed 8 years ago

OOM Crash [@ nsStyleSet::BeginShutdown] due to unhandled alloc in PresShell::Init

Categories

(Core :: CSS Parsing and Computation, defect)

Product:
Core
Component:
CSS Parsing and Computation
Platform:
x86_64
Linux
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: decoder, Unassigned)

References

Details

(Keywords: crash)

Crash Data

Tested on m-c revision 8ea5c983743f: It seems that an OOM condition in | PresShell::Init | can leave | mStyleSet | initialized to NULL which causes the following crash: Program received signal SIGSEGV, Segmentation fault. nsStyleSet::BeginShutdown (this=0x0, aPresContext=0x2221990) at /srv/repos/browser/mozilla-central/layout/style/nsStyleSet.cpp:1290 1290 mRoots.Clear(); // no longer valid, since we won't keep it up to date #0 nsStyleSet::BeginShutdown (this=0x0, aPresContext=0x2221990) at /srv/repos/browser/mozilla-central/layout/style/nsStyleSet.cpp:1290 #1 0x00002aaaac6b2517 in Destroy (this=0x24549f0) at /srv/repos/browser/mozilla-central/layout/base/nsPresShell.cpp:1248 #2 PresShell::Destroy (this=0x24549f0) at /srv/repos/browser/mozilla-central/layout/base/nsPresShell.cpp:1142 #3 0x00002aaaac6b2768 in PresShell::~PresShell (this=0x24549f0, __in_chrg=<optimized out>) at /srv/repos/browser/mozilla-central/layout/base/nsPresShell.cpp:968 #4 0x00002aaaac6b2a73 in PresShell::~PresShell (this=0x24549f0, __in_chrg=<optimized out>) at /srv/repos/browser/mozilla-central/layout/base/nsPresShell.cpp:990 #5 0x00002aaaac6a38c5 in PresShell::Release (this=0x24549f0) at /srv/repos/browser/mozilla-central/layout/base/nsPresShell.cpp:957 #6 0x00002aaaac8a0b59 in nsDocument::doCreateShell (this=<optimized out>, aContext=0x2221990, aViewManager=0x2249cc0, aStyleSet=0x2255520, aCompatMode=eCompatibility_NavQuirks, aInstancePtrResult=0x2221768) at /srv/repos/browser/mozilla-central/content/base/src/nsDocument.cpp:3217 #7 0x00002aaaac68743d in InitPresentationStuff (aDoInitialReflow=false, this=0x22216f0) at /srv/repos/browser/mozilla-central/layout/base/nsDocumentViewer.cpp:737 The backtrace of the failing allocation is as follows: #0 /srv/repos/browser/mozilla-central/objdir-ff-gcc64dbg/dist/bin/libmozalloc.so(moz_malloc+0x5f) #1 ChangeTable at objdir-ff-gcc64dbg/xpcom/build/pldhash.cpp:565 #2 PL_DHashTableOperate at objdir-ff-gcc64dbg/xpcom/build/pldhash.cpp:649 #3 nsPresArena::State::Allocate(unsigned int, unsigned long) at layout/base/nsPresArena.cpp:338 #4 nsStylePadding::operator new(unsigned long, nsPresContext*) at layout/style/nsStyleStruct.cpp:354 #5 nsStyleSet::BuildDefaultStyleData(nsPresContext*) at layout/style/nsStyleStructList.h:139 #6 nsStyleSet::Init(nsPresContext*) at layout/style/nsStyleSet.cpp:171 #7 PresShell::Init(nsIDocument*, nsPresContext*, nsIViewManager*, nsStyleSet*, nsCompatibility) at layout/base/nsPresShell.cpp:1044 #8 nsDocument::doCreateShell(nsPresContext*, nsIViewManager*, nsStyleSet*, nsCompatibility, nsIPresShell**) at content/base/src/nsDocument.cpp:3224
Component: Layout → Style System (CSS)
QA Contact: layout → style-system
Those allocations are infallible nowadays.
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.